Potential Configuration And Service Reconnaissance Via Reg.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Timur Zinniatullin, oscd.community
Source: github.com/SigmaHQ/sigma

Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Known false positives

Discord

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1007` System Service Discovery `T1012` Query Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Configuration And Service Reconnaissance Via Reg.EXE
id: 970007b7-ce32-49d0-a4a4-fbef016950bd
status: test
description: Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
author: Timur Zinniatullin, oscd.community
date: 2019-10-21
modified: 2023-02-05
tags:
    - attack.discovery
    - attack.t1012
    - attack.t1007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_flag:
        CommandLine|contains: 'query'
    selection_key:
        CommandLine|contains:
            - 'currentVersion\windows'
            - 'winlogon\'
            - 'currentVersion\shellServiceObjectDelayLoad'
            - 'currentVersion\run' # Also covers the strings "RunOnce", "RunOnceEx" and "runServicesOnce"
            - 'currentVersion\policies\explorer\run'
            - 'currentcontrolset\services'
    condition: all of selection_*
falsepositives:
    - Discord
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_flag`

selection_flag:
    CommandLine|contains: 'query'

Stage 3: `selection_key`

selection_key:
    CommandLine|contains:
        - 'currentVersion\windows'
        - 'winlogon\'
        - 'currentVersion\shellServiceObjectDelayLoad'
        - 'currentVersion\run'
        - 'currentVersion\policies\explorer\run'
        - 'currentcontrolset\services'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`currentVersion\policies\explorer\run` `currentVersion\run` `currentVersion\shellServiceObjectDelayLoad` `currentVersion\windows` `currentcontrolset\services` `query` corpus 8 (sigma 7, splunk 1) `winlogon\`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`
`OriginalFileName`	eq	`reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq value:"reg.exe"`